A business continuity plan exists to deal with situations that you hope will never happen. You cannot predict every scenario where it could be required, but a risk assessment should have identified those that are more likely. After creating a plan to address the scenarios and getting it signed off by various teams and senior management, many companies do little with it and don’t make updates to reflect changes in the business. Changes could be key staff, premises, types of work, technology etc.
There should be an annual test to check it would work. Options to consider are a full test, a desktop test or a discussion with the key stakeholders. This blog will look at doing a desktop test.
- Decide on the scenario. Pick something that is realistic. It may be a single event with the test team discussing what happens next and validating the plan. An alternative approach is to pick a series of events, pass these to the test team and have them validate the plan as the scenario develops
- Decide on how you want the test team to react. You can keep the scenario secret, or tell people about some or all of it in advance, so they have time to think of their response. The second approach can lead to more detailed discussions about the steps to be taken
- Pick a test team. It needs to have a facilitator, someone that makes notes of what happens and the test team leader. The rest of the team could be the key staff that would be involved if the plan had to be used, or others to see how they would react with this type of responsibility. The second approach can be useful in identifying issues that may not be apparent to the key staff
- Make sure the test team can attend, put it in their diary and book a suitable room
- Run the test. You can give the scenario verbally, by handing out papers or even by phone
- Write up the notes
- Follow up on actions that have come out of the test and update the plan
Government bodies have published some guidelines to help run tests. One example is from the Humber Emergency Planning service.